The vulnerability arises because the getNimbusConf method in Apache Storm Nimbus returned the complete daemon configuration without redacting sensitive credentials, relying only on a user-level authorization check. Additionally, the UI endpoint /api/v1/cluster/configuration did not have an authorization annotation, causing the authorization filter to bypass checks and return the full configuration under the UI daemon's principal. This allowed any user able to pass the UI filter to retrieve sensitive information such as storm.zookeeper.auth.payload and TLS keystore/truststore passwords. The flaw was inconsistent with other parts of the project that masked passwords before display. The issue was resolved in Apache Storm Nimbus 3.1.0 by masking sensitive values before serving configuration data and requiring explicit authorization annotations on all UI API endpoints. For users who cannot upgrade immediately, the recommended mitigation is to place the UI behind an authenticating reverse proxy restricting access to the vulnerable endpoint and to rotate exposed credentials.

An attacker who can access the UI endpoint /api/v1/cluster/configuration in affected versions can obtain sensitive credentials including ZooKeeper authentication payloads and TLS keystore/truststore passwords. This exposure could lead to unauthorized access to cluster components and compromise of secure communications. The vulnerability bypasses intended authorization controls, allowing any user passing the UI filter to retrieve these secrets, potentially enabling further attacks on the cluster's confidentiality and integrity.

Upgrade Apache Storm Nimbus to version 3.1.0 or later, where credential-bearing values are masked and all UI API endpoints require explicit authorization. If immediate upgrade is not possible, place the UI behind an authenticating reverse proxy that restricts access to /api/v1/cluster/configuration. Additionally, rotate any ZooKeeper authentication payloads and TLS keystore or truststore passwords that may have been exposed through this vulnerability.